Improve pipeline deploy attestation evidence gates

[danyili2632]

Summary

• addresses [REVIEW] pipeline-security: add deploy-time attestation verification gates #1372 by adding deploy-time attestation verification gates to pipeline-security
• expands CICD-SEC-9 beyond build-side provenance generation to require deploy/release verification and enforcement
• adds evidence gates for subject digest binding, verifier command/policy, issuer/certificate identity, source ref, builder ID, SLSA predicate validation, enforcement mode, exception owner, and multi-arch image handling
• updates report output with deploy-time verification evidence fields

Validation

• git diff --check
• verified required markers for deploy-time attestation verification, digest binding, identity constraints, SLSA predicate validation, enforcement mode, exception governance, multi-arch handling, and output evidence fields
• verified Markdown fence count is balanced

Bounty

• Target tier: Improver Moderate ($100) if accepted
• Preferred payment method: crypto, Base USDC 0x6CBF4b5cb88b8C2B7af776Bc2B073163B5d3C08A